Merge nwfilter createRuleInstance driver into applyNewRules
    
    The current nwfilter tech driver API has a 'createRuleInstance' method
    which populates virNWFilterRuleInstPtr with a command line string
    containing variable placeholders. The 'applyNewRules' method then
    expands the variables and executes the commands. This split of
    responsibility won't work when switching to the virFirewallPtr
    APIs, since we can't just build up command line strings. This patch
    this merges the functionality of 'createRuleInstance' into the
    applyNewRules method.
    
    The virNWFilterRuleInstPtr struct is changed from holding an array
    of opaque pointers, into holding generic metadata about the rules
    to be processed. In essence this is the result of taking a linked
    set of virNWFilterDefPtr's and flattening the tree to get a list
    of virNWFilterRuleDefPtr's. At the same time we must keep track of
    any nested virNWFilterObjPtr instances, so that the locks are held
    for the duration of the 'applyNewRules' method.
    
    Signed-off-by: Daniel P. Berrange <berrange@redhat.com>